Overview
overview
8Static
static
3HowToFishTrainer.exe
windows10-2004-x64
8HowToFishTrainer.exe
windows11-ltsc_2024-x64
8d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1dxil.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1res/Engine...api.js
windows10-2004-x64
3res/Engine...api.js
windows11-ltsc_2024-x64
8res/Engine...gex.js
windows10-2004-x64
3res/Engine...gex.js
windows11-ltsc_2024-x64
8res/Engine...ema.js
windows10-2004-x64
3res/Engine...ema.js
windows11-ltsc_2024-x64
8res/Extern...p1.exe
windows10-2004-x64
6res/Extern...p1.exe
windows11-ltsc_2024-x64
6res/Extern...p1.exe
windows10-2004-x64
res/Extern...p1.exe
windows11-ltsc_2024-x64
res/Extern...12.exe
windows10-2004-x64
4res/Extern...12.exe
windows11-ltsc_2024-x64
4res/Extern...12.exe
windows10-2004-x64
4res/Extern...12.exe
windows11-ltsc_2024-x64
4res/Extern...13.exe
windows10-2004-x64
4res/Extern...13.exe
windows11-ltsc_2024-x64
6res/Extern...64.exe
windows10-2004-x64
4res/Extern...64.exe
windows11-ltsc_2024-x64
6res/Extern...86.exe
windows10-2004-x64
4res/Extern...86.exe
windows11-ltsc_2024-x64
6vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
6vulkan-1.dll
windows10-2004-x64
1Analysis
- max time kernel
599s - max time network
482s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HowToFishTrainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
HowToFishTrainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
600 seconds
Behavioral task
behavioral3
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
res/Engine/Common/Include/SteamAPI/steam_api.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral9
Sample
res/Engine/Common/Include/SteamAPI/steam_api.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral10
Sample
res/Engine/Common/Include/rapidjson/internal/regex.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
res/Engine/Common/Include/rapidjson/internal/regex.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral12
Sample
res/Engine/Common/Include/rapidjson/schema.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral13
Sample
res/Engine/Common/Include/rapidjson/schema.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral14
Sample
res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
600 seconds
Behavioral task
behavioral15
Sample
res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
Behavioral task
behavioral16
Sample
res/External/Redistributables/2008/vcredist_x86_2008.sp1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral17
Sample
res/External/Redistributables/2008/vcredist_x86_2008.sp1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
600 seconds
Behavioral task
behavioral18
Sample
res/External/Redistributables/2012/vcredist_x64_2012.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral19
Sample
res/External/Redistributables/2012/vcredist_x64_2012.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral20
Sample
res/External/Redistributables/2012/vcredist_x86_2012.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral21
Sample
res/External/Redistributables/2012/vcredist_x86_2012.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral22
Sample
res/External/Redistributables/2013/vcredist_x64_2013.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral23
Sample
res/External/Redistributables/2013/vcredist_x64_2013.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
600 seconds
Behavioral task
behavioral24
Sample
res/External/Redistributables/2015andUp/VC_redist.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral25
Sample
res/External/Redistributables/2015andUp/VC_redist.x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral26
Sample
res/External/Redistributables/2015andUp/VC_redist.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral27
Sample
res/External/Redistributables/2015andUp/VC_redist.x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral28
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral29
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
General
- Target res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
- Size 2.6MB
- Sample260823-dq8dssxset
- SHA256 8648c5fc29c44b9112fe52f9a33f80e7fc42d10f3b5b42b2121542a13e44adfd
- MD5 4f1611f2d0ae799507f60c10ff8654c5
- SHA1 56ae8221e8024c8deed430e01a6160795c64cf53
- SHA512 f9a9f31010bcd890c1755ac3de2f6821a707aaeae2644cf083124dbdfdee86bd46206762e2487b942120970ca2ced2a87931b778e9fe4ae087d67b1865dd4b1a
- SSDEEP 49152:OqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyazw:OxxLFfY/KCCpKk9aWMzZyaM
- TLSH T162C5331259C0D23AE0A223B45EFD29635B3D7CB8772027EFB78650968D262C164357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist_x86_2005.sp1.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe - Drops file in Windows directory 61 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80DEU.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804664.0 msiexec.exe File created C:\Windows\SystemTemp\~DF73413CEDADF59BEC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFDA33E1AF6EC6B412.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804664.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80JPN.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804755.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804588.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804664.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804897.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804588.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804664.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804840.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80KOR.dll msiexec.exe File created C:\Windows\Installer\e59c809.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804840.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804840.0 msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File created C:\Windows\SystemTemp\~DFEE712C5B4A051B07.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804588.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804567.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804664.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804868.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804567.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804664.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804897.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\MSID2D7.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804664.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804868.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804909.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804567.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804588.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\Installer\e59c80d.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804922.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804588.0 msiexec.exe File created C:\Windows\SystemTemp\~DF1F553EA631091DC1.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804567.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804868.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804840.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804883.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804922.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804922.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804909.0 msiexec.exe File opened for modification C:\Windows\Installer\e59c809.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804588.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804755.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804883.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041804909.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804897.0 msiexec.exe File opened for modification C:\Windows\Installer\MSIFD62.tmp msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041804883.0 msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 3760 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5964 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86_2005.sp1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 56 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4868 msiexec.exe 4868 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5964 msiexec.exe Token: SeIncreaseQuotaPrivilege 5964 msiexec.exe Token: SeSecurityPrivilege 4868 msiexec.exe Token: SeCreateTokenPrivilege 5964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5964 msiexec.exe Token: SeLockMemoryPrivilege 5964 msiexec.exe Token: SeIncreaseQuotaPrivilege 5964 msiexec.exe Token: SeMachineAccountPrivilege 5964 msiexec.exe Token: SeTcbPrivilege 5964 msiexec.exe Token: SeSecurityPrivilege 5964 msiexec.exe Token: SeTakeOwnershipPrivilege 5964 msiexec.exe Token: SeLoadDriverPrivilege 5964 msiexec.exe Token: SeSystemProfilePrivilege 5964 msiexec.exe Token: SeSystemtimePrivilege 5964 msiexec.exe Token: SeProfSingleProcessPrivilege 5964 msiexec.exe Token: SeIncBasePriorityPrivilege 5964 msiexec.exe Token: SeCreatePagefilePrivilege 5964 msiexec.exe Token: SeCreatePermanentPrivilege 5964 msiexec.exe Token: SeBackupPrivilege 5964 msiexec.exe Token: SeRestorePrivilege 5964 msiexec.exe Token: SeShutdownPrivilege 5964 msiexec.exe Token: SeDebugPrivilege 5964 msiexec.exe Token: SeAuditPrivilege 5964 msiexec.exe Token: SeSystemEnvironmentPrivilege 5964 msiexec.exe Token: SeChangeNotifyPrivilege 5964 msiexec.exe Token: SeRemoteShutdownPrivilege 5964 msiexec.exe Token: SeUndockPrivilege 5964 msiexec.exe Token: SeSyncAgentPrivilege 5964 msiexec.exe Token: SeEnableDelegationPrivilege 5964 msiexec.exe Token: SeManageVolumePrivilege 5964 msiexec.exe Token: SeImpersonatePrivilege 5964 msiexec.exe Token: SeCreateGlobalPrivilege 5964 msiexec.exe Token: SeBackupPrivilege 5688 vssvc.exe Token: SeRestorePrivilege 5688 vssvc.exe Token: SeAuditPrivilege 5688 vssvc.exe Token: SeBackupPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeBackupPrivilege 4468 srtasks.exe Token: SeRestorePrivilege 4468 srtasks.exe Token: SeSecurityPrivilege 4468 srtasks.exe Token: SeTakeOwnershipPrivilege 4468 srtasks.exe Token: SeBackupPrivilege 4468 srtasks.exe Token: SeRestorePrivilege 4468 srtasks.exe Token: SeSecurityPrivilege 4468 srtasks.exe Token: SeTakeOwnershipPrivilege 4468 srtasks.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe Token: SeTakeOwnershipPrivilege 4868 msiexec.exe Token: SeRestorePrivilege 4868 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5964 msiexec.exe 5964 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5964 msiexec.exe 4868 msiexec.exe 3760 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4464 wrote to memory of 5964 4464 vcredist_x86_2005.sp1.exe 89 PID 4868 wrote to memory of 4468 4868 msiexec.exe 97 PID 4868 wrote to memory of 3760 4868 msiexec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\res\External\Redistributables\2005\vcredist_x86_2005.sp1.exe"C:\Users\Admin\AppData\Local\Temp\res\External\Redistributables\2005\vcredist_x86_2005.sp1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5964
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DEC012C7781705CD2AC6722A012E6DA22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3760
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6060
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 247KB
- SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
- MD5 cc064d4b81619991de8131a86ad77681
- SHA1 88d80d86cc20c27d7d2a872af719300bd2bb73f9
- SHA512 5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
- SSDEEP 6144:jdHDtJKx9Q5+LMfpMjU3B0QPdCtngtpoEvdpYKJFj9gGmO:xti+YLYpM45PUtgvTvdfDj9YO
- TLSH T18A4423C8D70C1D642630A1C948A55B6CCD9EA459790E35DA4282F2DE9E1D78FA0FC3F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 2.6MB
- SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
- MD5 b20bbeb818222b657df49a9cfe4fed79
- SHA1 3f6508e880b86502773a3275bc9527f046d45502
- SHA512 f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
- SSDEEP 49152:BxtG+uBvEH/sbE3EyyBU5czkhwZawV4mC5kRuhg6MmqmPAhe75LzNyS:TuVOTWBdzkkawxSh4iAhm51yS
- TLSH T1E9D5F153BA16E3A2E14862300757CA1C7D7E63E12763761D33FD2358889A6FAD33E548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID2D7.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- TLSH T193D20A93BA2494B3DD9031B101EE591652DEC7324B1598E36F1A0ECBBE74DC2DBB118B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ba9e21f09a27fa8469ae977ccaf06a8206cdfbab8415e62e46e9c850276a5c2e
- MD5 8ed57dcad62c7cf6e361fd7b8963f3fb
- SHA1 83c4ab432bec695e32ed1880dc29a408ce604347
- SHA512 6f28bb477e44a9c02f4c23dda501a7d1ac24a7f8b3423b62059c7fdeb8915788418742f35a8966bdf2832493ecf2341f260d7f002283d96118764078d5a8f346
- SSDEEP 24576:FFo3DMPMdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:MHI
- TLSH T19C57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0d416630-47e2-4fee-9fe1-eb67cba4bdf3}_OnDiskSnapshotProp
- Size 6KB
- SHA256 16d442c35f74c5f94d997719e0ce65cd30cb0db315bae1b4aab093e2d03d9eb4
- MD5 2c4f30f2a97ab1f8695ee8f76384b11d
- SHA1 fb32df9d07bef1d224bca19a78daaf126ec777a1
- SHA512 fa5e414fc565c61806748bb19a013132eacd2ae65b2e9103a3d6dc7f889faebd6d033dd9c993df1bd3868d0dc018a4a97989c37f716eb70552fa0a3264f13854
- SSDEEP 96:F4IK9bfvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:2IWb++uVmN
- TLSH T186D177185AF54711E2B3AB3228F14557A877B911EF33CB8E0198238E6631910F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH